Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 11:23

General

  • Target

    Riga Client.exe

  • Size

    2.0MB

  • MD5

    40ac7d11ebb91612d8d5c16c05af0a13

  • SHA1

    543a6c16f8f058fb6ba029ee3a9c5fde92aaa212

  • SHA256

    4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e

  • SHA512

    223ecc008fe3b9818597c3870ef605674eb96c52f8f140edb1d7c878691ce16c604440be77107c795a2bbb4e1b5c28ba94141e5703d9488c3a06580e38bf953c

  • SSDEEP

    49152:PbA3HdwWe2aSe6pcUwxE0G+dK7RB7/wWnm1Xl:Pbt2M4cUwxEII7RB0d1Xl

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Riga Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Riga Client.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\componentCommon\j1nvYpGjbyEFrc.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\componentCommon\ComInto.exe
          "C:\componentCommon\ComInto.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Recovery\WindowsRE\winlogon.exe
            "C:\Recovery\WindowsRE\winlogon.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46d9d007-0d58-490a-8708-01b0c73edafe.vbs"
              6⤵
                PID:628
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bfc0842-4a16-4437-b38c-75357d354c6d.vbs"
                6⤵
                  PID:2584
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3268
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:416
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4224
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1716
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4924
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3828
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3908
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1320
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4136
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:856
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3940
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3372
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4968
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:728
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\appcompat\Programs\sysmon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2712
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\appcompat\Programs\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1308
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\appcompat\Programs\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2496
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\upfc.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1268
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\upfc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3432
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\upfc.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3364
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3340
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3788
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:544

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\46d9d007-0d58-490a-8708-01b0c73edafe.vbs

        Filesize

        710B

        MD5

        bdbe869b12f8789377eb3cd4ca0a246a

        SHA1

        26fccb025912c7a9f62ad4bf0b7f2eb43aacd4fd

        SHA256

        8a340b77105395593fa51ae5e7d9439cc916919159aed9c0b9a2c2c626e3e8c5

        SHA512

        baac5832f0400bc019de3d2b66f6ff18674e7755550d187aaef464c0b6700fb50a1166e791b97b543f67fce75e77fafcf370b51b849f95bd3f0eeb89cc90d3d7

      • C:\Users\Admin\AppData\Local\Temp\5bfc0842-4a16-4437-b38c-75357d354c6d.vbs

        Filesize

        486B

        MD5

        7e7cf160c65c8fe5c58ba0750fe14dde

        SHA1

        36d1a519bfada22cd1480d2bbc095b72c2730b91

        SHA256

        91ea1c344d2d32c37596fe29c14ebf6dc80c975942a3666376f4fa29ea6d1bcc

        SHA512

        68c0ba824e53ef879d1f95159130188ff1262fff12682c9d64ff9651334de12ab7beb1c73fa662e6eae604460fde6f93c48c7389727ce9f48f20a74db1253646

      • C:\componentCommon\ComInto.exe

        Filesize

        1.6MB

        MD5

        9a0cee5a5ce317b7a70f88bb6aaa49e1

        SHA1

        95a779063656075a8ddc2f2164393fa59e3c93d9

        SHA256

        701924dd5d93b99a1e90fcd92f399c4453455e78375125f7a06aca20b84956bc

        SHA512

        d9c6240b6809c3decbdf4d97aca246f308670097b704b47449c53d8dc121f391d3ec6596f7947c36a01a388eeefe6f9ac9785698cf743f8a89c7cbf7b9da41a4

      • C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe

        Filesize

        206B

        MD5

        e986ea5d4cac976a6de65d3f1ef8b332

        SHA1

        6465da0abcfac05b8ed1f32b9cca57e2e2f54aea

        SHA256

        3ad8783bacfea22158df341d1bbedf8f6f0dcc4d9504555b36a756d2fcd83831

        SHA512

        896934c1a2941a8edfd38b03a858fc589cfb6622ae75019a542638be0c9c4e436aacd0916196dd71442d1a90404afa29d2864c92401222ff5ec2a712d873fa11

      • C:\componentCommon\j1nvYpGjbyEFrc.bat

        Filesize

        32B

        MD5

        a0b9b0891c2cae67cd1beae705d09d4f

        SHA1

        997953188d6226de19faa0ab4e8fdbddf1fb5617

        SHA256

        13593fab7a2113730fdbe4cbf436dde9a26116cda0bd4a33dff27d5678e9f9fc

        SHA512

        bdcd0c6a765c3927180706f7b30f2ea0f7cab6f27e512433839ebe3f6cb148923a6733ae954c24fa6eedeca97b8dc01cae945eea07e1121ff74885a69b34f2bb

      • memory/3216-21-0x000000001B770000-0x000000001B778000-memory.dmp

        Filesize

        32KB

      • memory/3216-23-0x000000001C490000-0x000000001C9B8000-memory.dmp

        Filesize

        5.2MB

      • memory/3216-17-0x000000001B6D0000-0x000000001B6D8000-memory.dmp

        Filesize

        32KB

      • memory/3216-16-0x000000001B720000-0x000000001B770000-memory.dmp

        Filesize

        320KB

      • memory/3216-19-0x000000001B700000-0x000000001B708000-memory.dmp

        Filesize

        32KB

      • memory/3216-18-0x000000001B6E0000-0x000000001B6F6000-memory.dmp

        Filesize

        88KB

      • memory/3216-20-0x000000001B710000-0x000000001B720000-memory.dmp

        Filesize

        64KB

      • memory/3216-14-0x0000000002C20000-0x0000000002C2E000-memory.dmp

        Filesize

        56KB

      • memory/3216-22-0x000000001B780000-0x000000001B792000-memory.dmp

        Filesize

        72KB

      • memory/3216-15-0x000000001B6B0000-0x000000001B6CC000-memory.dmp

        Filesize

        112KB

      • memory/3216-24-0x000000001B7C0000-0x000000001B7CC000-memory.dmp

        Filesize

        48KB

      • memory/3216-27-0x000000001B7F0000-0x000000001B7FE000-memory.dmp

        Filesize

        56KB

      • memory/3216-28-0x000000001B800000-0x000000001B80C000-memory.dmp

        Filesize

        48KB

      • memory/3216-26-0x000000001B7E0000-0x000000001B7EA000-memory.dmp

        Filesize

        40KB

      • memory/3216-25-0x000000001B7D0000-0x000000001B7D8000-memory.dmp

        Filesize

        32KB

      • memory/3216-29-0x000000001B810000-0x000000001B81C000-memory.dmp

        Filesize

        48KB

      • memory/3216-12-0x00007FF953743000-0x00007FF953745000-memory.dmp

        Filesize

        8KB

      • memory/3216-13-0x0000000000A00000-0x0000000000BAC000-memory.dmp

        Filesize

        1.7MB

      • memory/4944-57-0x000000001BD70000-0x000000001BD82000-memory.dmp

        Filesize

        72KB